<!DOCTYPE html><html><head>
      <title>nse</title>
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width, initial-scale=1.0">
      
      <link rel="stylesheet" href="file:///C:\Users\V5\.vscode\extensions\shd101wyy.markdown-preview-enhanced-0.3.11\node_modules\@shd101wyy\mume\dependencies\katex\katex.min.css">
      
      
      
      
      
      
      
      
      

      <style> 
      /**
 * prism.js Github theme based on GitHub's theme.
 * @author Sam Clarke
 */
code[class*="language-"],
pre[class*="language-"] {
  color: #333;
  background: none;
  font-family: Consolas, "Liberation Mono", Menlo, Courier, monospace;
  text-align: left;
  white-space: pre;
  word-spacing: normal;
  word-break: normal;
  word-wrap: normal;
  line-height: 1.4;

  -moz-tab-size: 8;
  -o-tab-size: 8;
  tab-size: 8;

  -webkit-hyphens: none;
  -moz-hyphens: none;
  -ms-hyphens: none;
  hyphens: none;
}

/* Code blocks */
pre[class*="language-"] {
  padding: .8em;
  overflow: auto;
  /* border: 1px solid #ddd; */
  border-radius: 3px;
  /* background: #fff; */
  background: #f5f5f5;
}

/* Inline code */
:not(pre) > code[class*="language-"] {
  padding: .1em;
  border-radius: .3em;
  white-space: normal;
  background: #f5f5f5;
}

.token.comment,
.token.blockquote {
  color: #969896;
}

.token.cdata {
  color: #183691;
}

.token.doctype,
.token.punctuation,
.token.variable,
.token.macro.property {
  color: #333;
}

.token.operator,
.token.important,
.token.keyword,
.token.rule,
.token.builtin {
  color: #a71d5d;
}

.token.string,
.token.url,
.token.regex,
.token.attr-value {
  color: #183691;
}

.token.property,
.token.number,
.token.boolean,
.token.entity,
.token.atrule,
.token.constant,
.token.symbol,
.token.command,
.token.code {
  color: #0086b3;
}

.token.tag,
.token.selector,
.token.prolog {
  color: #63a35c;
}

.token.function,
.token.namespace,
.token.pseudo-element,
.token.class,
.token.class-name,
.token.pseudo-class,
.token.id,
.token.url-reference .token.variable,
.token.attr-name {
  color: #795da3;
}

.token.entity {
  cursor: help;
}

.token.title,
.token.title .token.punctuation {
  font-weight: bold;
  color: #1d3e81;
}

.token.list {
  color: #ed6a43;
}

.token.inserted {
  background-color: #eaffea;
  color: #55a532;
}

.token.deleted {
  background-color: #ffecec;
  color: #bd2c00;
}

.token.bold {
  font-weight: bold;
}

.token.italic {
  font-style: italic;
}


/* JSON */
.language-json .token.property {
  color: #183691;
}

.language-markup .token.tag .token.punctuation {
  color: #333;
}

/* CSS */
code.language-css,
.language-css .token.function {
  color: #0086b3;
}

/* YAML */
.language-yaml .token.atrule {
  color: #63a35c;
}

code.language-yaml {
  color: #183691;
}

/* Ruby */
.language-ruby .token.function {
  color: #333;
}

/* Markdown */
.language-markdown .token.url {
  color: #795da3;
}

/* Makefile */
.language-makefile .token.symbol {
  color: #795da3;
}

.language-makefile .token.variable {
  color: #183691;
}

.language-makefile .token.builtin {
  color: #0086b3;
}

/* Bash */
.language-bash .token.keyword {
  color: #0086b3;
}html body{font-family:"Helvetica Neue",Helvetica,"Segoe UI",Arial,freesans,sans-serif;font-size:16px;line-height:1.6;color:#333;background-color:#fff;overflow:initial;box-sizing:border-box;word-wrap:break-word}html body>:first-child{margin-top:0}html body h1,html body h2,html body h3,html body h4,html body h5,html body h6{line-height:1.2;margin-top:1em;margin-bottom:16px;color:#000}html body h1{font-size:2.25em;font-weight:300;padding-bottom:.3em}html body h2{font-size:1.75em;font-weight:400;padding-bottom:.3em}html body h3{font-size:1.5em;font-weight:500}html body h4{font-size:1.25em;font-weight:600}html body h5{font-size:1.1em;font-weight:600}html body h6{font-size:1em;font-weight:600}html body h1,html body h2,html body h3,html body h4,html body h5{font-weight:600}html body h5{font-size:1em}html body h6{color:#5c5c5c}html body strong{color:#000}html body del{color:#5c5c5c}html body a:not([href]){color:inherit;text-decoration:none}html body a{color:#08c;text-decoration:none}html body a:hover{color:#00a3f5;text-decoration:none}html body img{max-width:100%}html body>p{margin-top:0;margin-bottom:16px;word-wrap:break-word}html body>ul,html body>ol{margin-bottom:16px}html body ul,html body ol{padding-left:2em}html body ul.no-list,html body ol.no-list{padding:0;list-style-type:none}html body ul ul,html body ul ol,html body ol ol,html body ol ul{margin-top:0;margin-bottom:0}html body li{margin-bottom:0}html body li.task-list-item{list-style:none}html body li>p{margin-top:0;margin-bottom:0}html body .task-list-item-checkbox{margin:0 .2em .25em -1.8em;vertical-align:middle}html body .task-list-item-checkbox:hover{cursor:pointer}html body blockquote{margin:16px 0;font-size:inherit;padding:0 15px;color:#5c5c5c;border-left:4px solid #d6d6d6}html body blockquote>:first-child{margin-top:0}html body blockquote>:last-child{margin-bottom:0}html body hr{height:4px;margin:32px 0;background-color:#d6d6d6;border:0 none}html body table{margin:10px 0 15px 0;border-collapse:collapse;border-spacing:0;display:block;width:100%;overflow:auto;word-break:normal;word-break:keep-all}html body table th{font-weight:bold;color:#000}html body table td,html body table th{border:1px solid #d6d6d6;padding:6px 13px}html body dl{padding:0}html body dl dt{padding:0;margin-top:16px;font-size:1em;font-style:italic;font-weight:bold}html body dl dd{padding:0 16px;margin-bottom:16px}html body code{font-family:Menlo,Monaco,Consolas,'Courier New',monospace;font-size:.85em !important;color:#000;background-color:#f0f0f0;border-radius:3px;padding:.2em 0}html body code::before,html body code::after{letter-spacing:-0.2em;content:"\00a0"}html body pre>code{padding:0;margin:0;font-size:.85em !important;word-break:normal;white-space:pre;background:transparent;border:0}html body .highlight{margin-bottom:16px}html body .highlight pre,html body pre{padding:1em;overflow:auto;font-size:.85em !important;line-height:1.45;border:#d6d6d6;border-radius:3px}html body .highlight pre{margin-bottom:0;word-break:normal}html body pre code,html body pre tt{display:inline;max-width:initial;padding:0;margin:0;overflow:initial;line-height:inherit;word-wrap:normal;background-color:transparent;border:0}html body pre code:before,html body pre tt:before,html body pre code:after,html body pre tt:after{content:normal}html body p,html body blockquote,html body ul,html body ol,html body dl,html body pre{margin-top:0;margin-bottom:16px}html body kbd{color:#000;border:1px solid #d6d6d6;border-bottom:2px solid #c7c7c7;padding:2px 4px;background-color:#f0f0f0;border-radius:3px}@media print{html body{background-color:#fff}html body h1,html body h2,html body h3,html body h4,html body h5,html body h6{color:#000;page-break-after:avoid}html body blockquote{color:#5c5c5c}html body pre{page-break-inside:avoid}html body table{display:table}html body img{display:block;max-width:100%;max-height:100%}html body pre,html body code{word-wrap:break-word;white-space:pre}}.markdown-preview{width:100%;height:100%;box-sizing:border-box}.markdown-preview .pagebreak,.markdown-preview .newpage{page-break-before:always}.markdown-preview pre.line-numbers{position:relative;padding-left:3.8em;counter-reset:linenumber}.markdown-preview pre.line-numbers>code{position:relative}.markdown-preview pre.line-numbers .line-numbers-rows{position:absolute;pointer-events:none;top:1em;font-size:100%;left:0;width:3em;letter-spacing:-1px;border-right:1px solid #999;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none}.markdown-preview pre.line-numbers .line-numbers-rows>span{pointer-events:none;display:block;counter-increment:linenumber}.markdown-preview pre.line-numbers .line-numbers-rows>span:before{content:counter(linenumber);color:#999;display:block;padding-right:.8em;text-align:right}.markdown-preview .mathjax-exps .MathJax_Display{text-align:center !important}.markdown-preview:not([for="preview"]) .code-chunk .btn-group{display:none}.markdown-preview:not([for="preview"]) .code-chunk .status{display:none}.markdown-preview:not([for="preview"]) .code-chunk .output-div{margin-bottom:16px}.scrollbar-style::-webkit-scrollbar{width:8px}.scrollbar-style::-webkit-scrollbar-track{border-radius:10px;background-color:transparent}.scrollbar-style::-webkit-scrollbar-thumb{border-radius:5px;background-color:rgba(150,150,150,0.66);border:4px solid rgba(150,150,150,0.66);background-clip:content-box}html body[for="html-export"]:not([data-presentation-mode]){position:relative;width:100%;height:100%;top:0;left:0;margin:0;padding:0;overflow:auto}html body[for="html-export"]:not([data-presentation-mode]) .markdown-preview{position:relative;top:0}@media screen and (min-width:914px){html body[for="html-export"]:not([data-presentation-mode]) .markdown-preview{padding:2em calc(50% - 457px)}}@media screen and (max-width:914px){html body[for="html-export"]:not([data-presentation-mode]) .markdown-preview{padding:2em}}@media screen and (max-width:450px){html body[for="html-export"]:not([data-presentation-mode]) .markdown-preview{font-size:14px !important;padding:1em}}@media print{html body[for="html-export"]:not([data-presentation-mode]) #sidebar-toc-btn{display:none}}html body[for="html-export"]:not([data-presentation-mode]) #sidebar-toc-btn{position:fixed;bottom:8px;left:8px;font-size:28px;cursor:pointer;color:inherit;z-index:99;width:32px;text-align:center;opacity:.4}html body[for="html-export"]:not([data-presentation-mode])[html-show-sidebar-toc] #sidebar-toc-btn{opacity:1}html body[for="html-export"]:not([data-presentation-mode])[html-show-sidebar-toc] .md-sidebar-toc{position:fixed;top:0;left:0;width:300px;height:100%;padding:32px 0 48px 0;font-size:14px;box-shadow:0 0 4px rgba(150,150,150,0.33);box-sizing:border-box;overflow:auto;background-color:inherit}html body[for="html-export"]:not([data-presentation-mode])[html-show-sidebar-toc] .md-sidebar-toc::-webkit-scrollbar{width:8px}html body[for="html-export"]:not([data-presentation-mode])[html-show-sidebar-toc] .md-sidebar-toc::-webkit-scrollbar-track{border-radius:10px;background-color:transparent}html body[for="html-export"]:not([data-presentation-mode])[html-show-sidebar-toc] .md-sidebar-toc::-webkit-scrollbar-thumb{border-radius:5px;background-color:rgba(150,150,150,0.66);border:4px solid rgba(150,150,150,0.66);background-clip:content-box}html body[for="html-export"]:not([data-presentation-mode])[html-show-sidebar-toc] .md-sidebar-toc a{text-decoration:none}html body[for="html-export"]:not([data-presentation-mode])[html-show-sidebar-toc] .md-sidebar-toc ul{padding:0 1.6em;margin-top:.8em}html body[for="html-export"]:not([data-presentation-mode])[html-show-sidebar-toc] .md-sidebar-toc li{margin-bottom:.8em}html body[for="html-export"]:not([data-presentation-mode])[html-show-sidebar-toc] .md-sidebar-toc ul{list-style-type:none}html body[for="html-export"]:not([data-presentation-mode])[html-show-sidebar-toc] .markdown-preview{left:300px;width:calc(100% -  300px);padding:2em calc(50% - 457px -  150px);margin:0;box-sizing:border-box}@media screen and (max-width:1274px){html body[for="html-export"]:not([data-presentation-mode])[html-show-sidebar-toc] .markdown-preview{padding:2em}}@media screen and (max-width:450px){html body[for="html-export"]:not([data-presentation-mode])[html-show-sidebar-toc] .markdown-preview{width:100%}}html body[for="html-export"]:not([data-presentation-mode]):not([html-show-sidebar-toc]) .markdown-preview{left:50%;transform:translateX(-50%)}html body[for="html-export"]:not([data-presentation-mode]):not([html-show-sidebar-toc]) .md-sidebar-toc{display:none}
/* Please visit the URL below for more information: */
/*   https://shd101wyy.github.io/markdown-preview-enhanced/#/customize-css */
 
      </style>
    </head>
    <body for="html-export">
      <div class="mume markdown-preview   ">
      <h1 class="mume-header" id="1-nse">1. NSE</h1>

<h2 class="mume-header" id="11-nse%E8%84%9A%E6%9C%AC%E8%BF%90%E8%A1%8C">1.1. NSE&#x811A;&#x672C;&#x8FD0;&#x884C;</h2>

<pre data-role="codeBlock" data-info="bash" class="language-bash">namap -sC -sV -O scanme.Nmap.org

// -O &#x68C0;&#x6D4B;&#x76EE;&#x6807;&#x7CFB;&#x7EDF;&#x7684;&#x64CD;&#x4F5C;&#x7CFB;&#x7EDF;
// -sV &#x68C0;&#x6D4B;&#x76EE;&#x6807;&#x7CFB;&#x7EDF;&#x4E0A;&#x7684;&#x670D;&#x52A1; 
// -sC &#x7528;default&#x5206;&#x7C7B;&#x4E2D;&#x6240;&#x6709;&#x811A;&#x672C;&#x5BF9;&#x76EE;&#x6807;&#x7CFB;&#x7EDF;&#x8FDB;&#x884C;&#x68C0;&#x6D4B; --script Default

</pre><p><img src="nse_sCdefault.png" alt=""></p>
<p><img src="img/nse_default.png" alt=""></p>
<hr>
<p><em>&#x811A;&#x672C;&#x5206;&#x7C7B;</em></p>
<p><img src="img/nse_type.png" alt=""></p>
<hr>
<pre data-role="codeBlock" data-info="bash" class="language-bash">// &#x4F7F;&#x7528;http-methods.nse&#x811A;&#x672C;&#x6765;&#x679A;&#x4E3E;&#x76EE;&#x6807;&#x673A;&#x5668;&#x4E0A;&#x6240;&#x8FD0;&#x884C;&#x7684;&#x670D;&#x52A1;
nmap -p 80,443 --script http-methods 192.168.31.1  

// &#x4F7F;&#x7528;&#x591A;&#x4E2A;&#x5206;&#x7C7B;&#x4E2D;&#x7684;&#x811A;&#x672C;&#x5BF9;&#x76EE;&#x6807;&#x8FDB;&#x884C;&#x626B;&#x63CF;
nmap --script discovery,intrusive 192.168.31.1

// &#x4F7F;&#x7528;&#x591A;&#x4E2A;&#x811A;&#x672C;&#x5BF9;&#x76EE;&#x6807;&#x8FDB;&#x884C;&#x626B;&#x63CF;
nmap --script filename1,filename2 192.168.31.1 

// &#x4F7F;&#x7528;&#x9664;&#x4E86;exploit&#x3001;intrusive&#x3001;dos&#x5206;&#x7C7B;&#x4EE5;&#x5916;&#x7684;&#x811A;&#x672C;&#x5BF9;&#x76EE;&#x6807;&#x8FDB;&#x884C;&#x63A2;&#x6D4B; 
nmap --sV --script <span class="token string">&quot;not (exploit or dos or intrusive)&quot;</span> 192.168.31.1

// &#x652F;&#x6301;&#x901A;&#x914D;&#x7B26;*
nmap --script <span class="token string">&quot;snmp-*&quot;</span> 192.168.31.1

// intrusive&#x5206;&#x7C7B;&#x4EE5;&#x5916;&#x7684; ftp-* &#x7684;&#x811A;&#x672C;
nmap --script <span class="token string">&quot;ftp-* and not (intrusive)&quot;</span> 192.168.31.1

// &#x4F7F;&#x7528;&#x7684;&#x65F6;&#x5019;&#x4F20;&#x9012;&#x53C2;&#x6570;
nmap -p 80 --script http-methods --script-args http.useragent<span class="token operator">=</span><span class="token string">&quot;Mozilla 42&quot;</span> 192.168.31.1

// &#x4ECE;&#x6587;&#x4EF6;&#x4E2D;&#x8F7D;&#x5165;&#x811A;&#x672C;&#x53C2;&#x6570;
nmap --script http-methods --script-args-file myargs.txt 192.168.31.1

</pre><p><img src="img/nse_myargs.txt.png" alt=""></p>
<p>// &#x53EF;&#x4EE5;&#x67E5;&#x770B;&#x811A;&#x672C;&#x6240;&#x53D1;&#x9001;&#x7684;payload<br>
<code>namp --script http-methods --script-trace 192.168.31.1</code></p>
<p><img src="img/nse_script-trace.png" alt=""></p>
<p>// &#x4F7F;&#x7528;&#x8C03;&#x8BD5;&#x6A21;&#x5F0F;  -d[1-9] &#x6570;&#x5B57;&#x8D8A;&#x5927;&#xFF0C;&#x8F93;&#x51FA;&#x8981;&#x8BE6;&#x7EC6;</p>
<p><img src="img/nse_d9.png" alt=""></p>
<p>// &#x4F7F;&#x7528; --packet-trace &#x53EF;&#x4EE5;&#x67E5;&#x770B;&#x6240;&#x6709;&#x53D1;&#x9001;&#x548C;&#x6536;&#x5230;&#x7684;&#x5305;</p>
<p><code>namp --script http-methods --packet-trace 192.168.31.1</code></p>
<p><img src="img/nse_packettrace.png" alt=""></p>
<h2 class="mume-header" id="12-nse-code%E5%9F%BA%E7%A1%80">1.2. NSE code&#x57FA;&#x7840;</h2>

<h3 class="mume-header" id="121-%E5%BC%80%E5%8F%91%E7%8E%AF%E5%A2%83">1.2.1. &#x5F00;&#x53D1;&#x73AF;&#x5883;</h3>

<p>Halcyon &#x6BD4;&#x8F83;&#x5408;&#x9002;&#xFF0C;&#x5F53;&#x7136;&#x7528;&#x8BB0;&#x4E8B;&#x672C;&#x4E5F;&#x53EF;&#x4EE5;</p>
<p>Halcyon ide&#x662F;java&#x5199;&#x7684;&#xFF0C;&#x9996;&#x5148;&#x8981;&#x4FDD;&#x8BC1;&#x7535;&#x8111;&#x4E0A;&#x7684;java&#x73AF;&#x5883;&#x662F;ok&#x7684;</p>
<p>&#x5B98;&#x7F51;&#x5730;&#x5740;&#xFF1A; <code>https://halcyon-ide.org/</code></p>
<p>&#x4E0B;&#x8F7D;&#x5B8C;&#x6210;&#x540E;&#xFF0C;&#x6267;&#x884C;</p>
<p><code>java -jar Halcyon_IDE_v2.0.1jar</code></p>
<p>&#x4E00;&#x822C;&#x4F1A;&#x5F39;&#x51FA;&#x8FD9;&#x4E2A;&#x6846;</p>
<p><img src="img/halcyon_config.png" alt=""></p>
<p>&#x70B9;&#x662F;&#xFF0C;&#x7136;&#x540E;&#x8FDB;&#x5165;&#x4E0B;&#x4E00;&#x6B65;</p>
<p><img src="img/nse_configure.png" alt=""></p>
<p>&#x8BBE;&#x7F6E;&#x597D;&#x76F8;&#x5173;&#x7684;&#x8DEF;&#x5F84;&#xFF0C; &#x7136;&#x540E;&#x70B9;&#x51FB;Apply&#x8FDB;&#x884C;&#x4E0B;&#x4E00;&#x6B65;</p>
<p><img src="img/halcyon_restart.png" alt=""></p>
<p>&#x70B9;&#x662F;&#xFF0C;&#x91CD;&#x542F;&#x3002;</p>
<p><img src="img/halcyon_new.png" alt=""></p>
<p>new&#x4E00;&#x4E2A;&#x65B0;&#x9879;&#x76EE;&#xFF0C;</p>
<p><img src="img/halcyon_new_set.png" alt=""></p>
<p>&#x7136;&#x540E;&#x5C31;&#x751F;&#x6210;&#x4E86;&#x4E00;&#x4E2A;&#x9ED8;&#x8BA4;&#x7684;&#x811A;&#x672C;&#x6587;&#x4EF6;</p>
<p><img src="img/nse_default_code.png" alt=""></p>
<p>&#x4FDD;&#x5B58;&#xFF0C;&#x5C06;&#x811A;&#x672C;&#x653E;&#x5728;&#x9ED8;&#x8BA4;&#x7684;nmap&#x5B89;&#x88C5;&#x76EE;&#x5F55;&#x7684;scripts&#x6587;&#x4EF6;&#x5939;&#x4E2D;&#xFF0C;&#x66F4;&#x65B0;<br>
(&#x70B9;Export Script &#x9ED8;&#x8BA4;&#x4F1A;&#x66F4;&#x65B0;&#xFF0C;&#x5176;&#x5B9E;&#x4E5F;&#x5C31;&#x662F;&#x6267;&#x884C; nmap --script-updatedb )<br>
<img src="img/nse_333.png" alt=""></p>
<p><img src="img/nse_rule.png" alt=""></p>
<p>&#x6765;&#x4E00;&#x4E2A;hello world!</p>
<p>&#x76EE;&#x6807;&#x673A;&#x5668;&#x4E0A;&#x5F00;&#x653E;&#x7684;80&#x7AEF;&#x53E3;&#x8FD0;&#x884C;&#x7740;HTTP&#x670D;&#x52A1;&#x7684;&#x65F6;&#x5019;&#xFF0C;&#x6267;&#x884C;action, &#x4E5F;&#x5C31;&#x662F;&#x6253;&#x5370;&#x4E2A; This is WebServer!</p>
<p><img src="img/nse_one.png" alt=""></p>
<p>&#x7136;&#x540E;&#x76F4;&#x63A5;&#x8FD0;&#x884C; Project -&gt; Run</p>
<p><img src="img/run_one.png" alt=""></p>
<p>&#x5F53;&#x7136;&#x76F4;&#x63A5;&#x5728;namp&#x91CC;&#x8DD1;&#x4E5F;&#x6CA1;&#x6709;&#x95EE;&#x9898;</p>
<p><img src="img/nmap_one_run.png" alt=""></p>
<h2 class="mume-header" id="13-nse%E5%AE%9E%E4%BE%8Bsmtp-strangeportnse">1.3. nse&#x5B9E;&#x4F8B;&#xFF1A;smtp-strangeport.nse</h2>

<p>stmp-strangeport.nse &#x662F;&#x4E00;&#x4E2A;&#x7B80;&#x5355;&#x7684;nse&#x5B9E;&#x4F8B;&#xFF0C;&#x5B9E;&#x73B0;&#x7684;&#x529F;&#x80FD;&#x662F; &#x5BF9;&#x76EE;&#x6807;&#x4E3B;&#x673A;&#x7684;&#x7AEF;&#x53E3;&#x8FDB;&#x884C;&#x68C0;&#x6D4B;&#xFF0C;&#x67E5;&#x770B;&#x662F;&#x5426;&#x6709;&#x5F02;&#x5E38;&#x7AEF;&#x53E3;&#x5F00;&#x653E;&#x4E86;SMTP&#x670D;&#x52A1;&#xFF08;&#x5176;&#x5B9E;&#x5C31;&#x662F;&#x7AEF;&#x53E3;&#x53F7;&#x4E0D;&#x7B49;&#x4E8E;25&#x3001;465&#x3001;587&#xFF09;&#xFF0C;&#x6700;&#x540E;&#x8F93;&#x51FA;&#x5F02;&#x5E38;&#x7684;&#x7AEF;&#x53E3;&#x3002;</p>
<pre data-role="codeBlock" data-info="lua" class="language-lua">description <span class="token operator">=</span> <span class="token string">[[
Checks if SMTP is running on a non-standard port.

This may indicate that crackers or script kiddies have set up a backdoor on the
system to send spam or control the machine.
]]</span>

<span class="token comment">---</span>
<span class="token comment">-- @output</span>
<span class="token comment">-- 22/tcp  open   smtp</span>
<span class="token comment">-- |_ smtp-strangeport: Mail server on unusual port: possible malware</span>

author <span class="token operator">=</span> <span class="token string">&quot;Diman Todorov&quot;</span>

license <span class="token operator">=</span> <span class="token string">&quot;Same as Nmap--See https://nmap.org/book/man-legal.html&quot;</span>

categories <span class="token operator">=</span> <span class="token punctuation">{</span><span class="token string">&quot;malware&quot;</span><span class="token punctuation">,</span> <span class="token string">&quot;safe&quot;</span><span class="token punctuation">}</span>

portrule <span class="token operator">=</span> <span class="token keyword">function</span><span class="token punctuation">(</span>host<span class="token punctuation">,</span> port<span class="token punctuation">)</span>
  <span class="token keyword">return</span> port<span class="token punctuation">.</span>service <span class="token operator">==</span> <span class="token string">&quot;smtp&quot;</span> <span class="token keyword">and</span>
    port<span class="token punctuation">.</span>number <span class="token operator">~=</span> <span class="token number">25</span> <span class="token keyword">and</span> port<span class="token punctuation">.</span>number <span class="token operator">~=</span> <span class="token number">465</span> <span class="token keyword">and</span> port<span class="token punctuation">.</span>number <span class="token operator">~=</span> <span class="token number">587</span>
    <span class="token keyword">and</span> port<span class="token punctuation">.</span>protocol <span class="token operator">==</span> <span class="token string">&quot;tcp&quot;</span>
    <span class="token keyword">and</span> port<span class="token punctuation">.</span>state <span class="token operator">==</span> <span class="token string">&quot;open&quot;</span>
<span class="token keyword">end</span>

action <span class="token operator">=</span> <span class="token keyword">function</span><span class="token punctuation">(</span><span class="token punctuation">)</span>
  <span class="token keyword">return</span> <span class="token string">&quot;Mail server on unusual port: possible malware&quot;</span>
<span class="token keyword">end</span>
</pre><h2 class="mume-header" id="14-nse%E4%B8%AD%E7%9A%84api">1.4. NSE&#x4E2D;&#x7684;API</h2>

<p>&#x8FDB;&#x884C;NSE&#x5F00;&#x53D1;&#x7684;&#x65F6;&#xFF0C;&#x53EF;&#x4EE5;&#x5145;&#x5206;&#x5229;&#x7528;Nmap&#x626B;&#x63CF;&#x7F51;&#x7EDC;&#x65F6;&#x83B7;&#x5F97;&#x7684;&#x5173;&#x4E8E;&#x4E3B;&#x673A;&#x548C;&#x7AEF;&#x53E3;&#x7684;&#x4FE1;&#x606F;&#x3002; NSE&#x4E2D;&#x7684;API&#x5C31;&#x662F;&#x8FDE;&#x63A5;&#x811A;&#x672C;&#x4E0E;&#x626B;&#x63CF;&#x7ED3;&#x679C;&#x4E4B;&#x95F4;&#x7684;&#x6865;&#x6881;&#x3002;</p>
<h3 class="mume-header" id="141-nmap-api">1.4.1. Nmap API</h3>

<p>Nmap&#x4E2D;API&#x7684;&#x6838;&#x5FC3;&#x529F;&#x80FD;&#x5C31;&#x662F;&#x5411;&#x811A;&#x672C;&#x63D0;&#x4F9B;&#x5173;&#x4E8E;&#x4E3B;&#x673A;&#x548C;&#x7AEF;&#x53E3;&#x7684;&#x4FE1;&#x606F;&#x3002;</p>
<p>Nmap&#x4E2D;&#x7684;&#x5F15;&#x64CE;&#x4F1A;&#x5411;&#x811A;&#x672C;&#x4F20;&#x9012;&#x5982;&#x4E0B;&#x4E24;&#x4E2A;Lua table&#x7C7B;&#x578B;&#x7684;&#x53C2;&#x6570;&#xFF1A;<br>
- <em>host table</em><br>
- <em>port table</em></p>
<p>&#x53EF;&#x4EE5;&#x7528;&#x4EE5;&#x4E0B;&#x811A;&#x672C;&#x6765;&#x6D4B;&#x8BD5;host &#x4EE5;&#x53CA; port&#x7684;&#x503C;, line 17  <code>return host</code> &#x6216;&#x8005; <code>retrun port</code><br>
<img src="img/test_host_port.png" alt=""></p>
<h4 class="mume-header" id="1411-host-table">1.4.1.1. host table</h4>

<ol>
<li>host.os</li>
<li>host.ip</li>
<li><a href="http://host.name">host.name</a></li>
<li>host.targetname</li>
<li>host.directly_connected</li>
<li>host.mac_addr</li>
<li>host.mac_addr_src</li>
<li>host.interface_mtu</li>
<li>host.bin_ip</li>
<li>host.bin_ip_src</li>
<li>host.times</li>
<li>host.traceroute  &#x6CE8;&#x610F;&#xFF0C; &#x6B64;&#x5B57;&#x6BB5;&#x53EA;&#x6709;&#x5728;&#x6307;&#x5B9A; --traceroute&#x65F6;&#x624D;&#x6709;&#x7528;<br>
<img src="img/host_traceroute.png" alt=""></li>
</ol>
<p><img src="img/host_host.png" alt=""></p>
<h4 class="mume-header" id="1412-port-table">1.4.1.2. port table</h4>

<ol>
<li>port.number</li>
<li>port.protocol</li>
<li>port.service</li>
<li>port.version</li>
<li>port.state</li>
</ol>
<p><img src="img/port_port.png" alt=""></p>
<h3 class="mume-header" id="142-nse%E4%B8%AD%E7%9A%84%E5%BC%82%E5%B8%B8%E5%A4%84%E7%90%86">1.4.2. NSE&#x4E2D;&#x7684;&#x5F02;&#x5E38;&#x5904;&#x7406;</h3>

<p>// &#x8FD9;&#x5757;&#x6709;&#x70B9;&#x7591;&#x95EE;&#xFF0C;&#x4EE5;&#x540E;&#x5728;&#x5904;&#x7406;</p>
<pre data-role="codeBlock" data-info="lua" class="language-lua"><span class="token keyword">local</span> comm <span class="token operator">=</span> require <span class="token string">&quot;comm&quot;</span>
<span class="token keyword">local</span> nmap <span class="token operator">=</span> require <span class="token string">&quot;nmap&quot;</span>
<span class="token keyword">local</span> shortport <span class="token operator">=</span> require <span class="token string">&quot;shortport&quot;</span>

description <span class="token operator">=</span> <span class="token string">[[&#x8FD9;&#x662F;&#x4E00;&#x4E2A;&#x5F02;&#x5E38;&#x5904;&#x7406;&#x7684;demo
]]</span>

author <span class="token operator">=</span> <span class="token string">&quot;V5&quot;</span>
license <span class="token operator">=</span> <span class="token string">&quot;Same as Nmap--See http://nmap.org/book/man-legal.html&quot;</span>
categories <span class="token operator">=</span> <span class="token punctuation">{</span><span class="token string">&quot;default&quot;</span><span class="token punctuation">}</span>


portrule <span class="token operator">=</span> shortport<span class="token punctuation">.</span><span class="token function">port_or_service</span><span class="token punctuation">(</span><span class="token number">80</span><span class="token punctuation">,</span><span class="token string">&quot;http&quot;</span><span class="token punctuation">)</span>

<span class="token keyword">local</span> fun1 <span class="token operator">=</span> <span class="token keyword">function</span><span class="token punctuation">(</span><span class="token punctuation">)</span> 
	<span class="token keyword">return</span> <span class="token string">&quot;this is catch&quot;</span> 
<span class="token keyword">end</span>

action <span class="token operator">=</span> <span class="token keyword">function</span><span class="token punctuation">(</span>host<span class="token punctuation">,</span> port<span class="token punctuation">)</span>
 

	<span class="token keyword">local</span> try <span class="token operator">=</span> nmap<span class="token punctuation">.</span><span class="token function">new_try</span><span class="token punctuation">(</span>fun1<span class="token punctuation">)</span>

	<span class="token keyword">return</span> <span class="token function">try</span><span class="token punctuation">(</span>comm<span class="token punctuation">.</span><span class="token function">exchange</span><span class="token punctuation">(</span>host<span class="token punctuation">,</span>port<span class="token punctuation">,</span><span class="token string">&quot;\r\n&quot;</span><span class="token punctuation">,</span><span class="token punctuation">{</span>lines<span class="token operator">=</span><span class="token number">100</span><span class="token punctuation">,</span> timeout<span class="token operator">=</span><span class="token number">5000</span><span class="token punctuation">}</span><span class="token punctuation">)</span><span class="token punctuation">)</span>
<span class="token keyword">end</span>


</pre><h3 class="mume-header" id="143-nse%E4%B8%AD%E7%9A%84%E6%B3%A8%E5%86%8C%E8%A1%A8">1.4.3. NSE&#x4E2D;&#x7684;&#x6CE8;&#x518C;&#x8868;</h3>

<p>NSE&#x4E2D;&#x7684;&#x6CE8;&#x518C;&#x8868;&#x662F;&#x4E00;&#x4E2A;lua table &#x7C7B;&#x578B;&#x7684;&#x6570;&#x636E;&#x6587;&#x4EF6;&#xFF0C;&#x5B83;&#x7528;&#x6765;&#x4FDD;&#x5B58;&#x5728;&#x4E00;&#x6B21;&#x626B;&#x63CF;&#x4E2D;&#x5404;&#x4E2A;&#x811A;&#x672C;&#x4E4B;&#x95F4;&#x5171;&#x4EAB;&#x7684;&#x53D8;&#x91CF;&#xFF0C; &#x8FD9;&#x4E2A;&#x6CE8;&#x518C;&#x8868;&#x4FDD;&#x5B58;&#x5728;&#x4E00;&#x4E2A;&#x540D;&#x4E3A;Nmap.registry&#x7684;&#x53D8;&#x91CF;&#x4E2D;&#x3002;</p>
<p>&#x4E3E;&#x4E2A;&#x4F8B;&#x5B50;&#xFF0C;&#x5728;&#x4F7F;&#x7528;&#x811A;&#x672C;&#x5BF9;&#x76EE;&#x6807;&#x7684;&#x53E3;&#x4EE4;&#x8FDB;&#x884C;&#x66B4;&#x529B;&#x7834;&#x89E3;&#x65F6;&#xFF0C;&#x53EF;&#x4EE5;&#x4F7F;&#x7528;&#x8FD9;&#x4E2A;&#x6CE8;&#x518C;&#x8868;&#x62A5;&#x5DF2;&#x7ECF;&#x6210;&#x529F;&#x7684;&#x7528;&#x6237;&#x540D;&#x548C;&#x5BC6;&#x7801;&#x4FDD;&#x5B58;&#x8D77;&#x6765;&#xFF0C;&#x4EE5;&#x4F9B;&#x5176;&#x4ED6;&#x811A;&#x672C;&#x4F7F;&#x7528;&#x3002;&#x4F8B;&#x5982;&#xFF0C;&#x7834;&#x89E3;&#x5230;&#x4E86;&#x76EE;&#x6807;&#x7684;&#x7528;&#x6237;&#x540D;&#x4E3A;admin &#x5BC6;&#x7801;&#x4E3A;123456,NSE&#x5C31;&#x4F1A;&#x6267;&#x884C;&#x4E00;&#x4E2A;&#x63D2;&#x5165;&#x64CD;&#x4F5C; <code>table.insert(nmap.registry.credentials.http, {username = admin,passwdord = 123456 }</code></p>
<p>-- &#x672A;&#x5B8C;&#x5F85;&#x7EED; --</p>

      </div>
      
      
    
    
    
    
    
    
    
    
  
    </body></html>